WeChat Zero-Click Vulnerability Exposes Millions to Autonomous Worm

A critical zero-click vulnerability in the WeChat VoIP stack allowed researchers to construct an autonomous worm capable of compromising user accounts simply by placing a call, according to The Register Security. Security firm Calif discovered the memory corruption bug, designated WeWorm, which impacts both iOS and Android platforms across Tencent's ecosystem. Because WeChat boasts more than 1.4 billion monthly active users worldwide, the flaw presented an unprecedented vector for large-scale automated takeovers without requiring victims to interact with their devices or answer incoming calls.

How the WeWorm Zero-Click Exploit Operates

The WeWorm exploit leverages a memory corruption flaw within the WeChat VoIP handling stack to achieve complete account compromise within seconds of an incoming call ringing on a victim's device. When a trusted contact initiates the sequence, the malicious payload executes in the background without user intervention, granting attackers full permissions to read messages, send communications, and initiate further calls on the victim's behalf. Researchers demonstrated that declining an incoming call successfully halted the infection chain, but letting the phone ring or allowing the call to continue active propagation resulted in a compromised state where the software autonomously targeted other contacts in the address book.

• Discovered by security researchers at Calif on iOS and Android.
• Leverages a memory corruption bug inside the WeChat VoIP stack.
• Requires zero user interaction beyond receiving a ringing call.
• Successfully patched by Tencent on August 21.

The autonomous propagation mechanism mirrors classical worm behavior, utilizing trusted social graphs to jump from one device to another without leaving obvious warning signs for the recipient. Attackers could theoretically script automated loops that scan for active users, target them while they are away from their screens, and silently propagate the payload across enterprise and personal networks before anyone notices the unauthorized activity.

Tencent Patch Deployment and Withheld Details

Tencent deployed critical security patches to address the zero-click vulnerability on August 21, mitigating the immediate threat across its global user base of over 1.4 billion people. Despite the swift remediation by the technology giant, the research team at Calif chose to withhold technical specifics and granular exploit code to prevent copycat actors from weaponizing the flaw before affected devices received updates. Zero-click exploits targeting mainstream messaging applications represent a severe escalation in mobile threat sophistication, bypassing traditional perimeter defenses and social engineering requirements entirely.

Exploitation takes only seconds, and gives us full control of the WeChat account. We can read and send messages, make calls, and act on the victim's behalf.

Security teams managing enterprise environments where employees use personal or company-issued mobile devices for messaging must prioritize software updates to ensure all WeChat installations are running versions post-dating the August patch. While the prompt remediation by Tencent prevented widespread real-world exploitation, the incident highlights the fragile security surface area of modern communications stacks handling real-time audio and video streams.

What to watch next

Security professionals and enterprise IT administrators should monitor three key signals regarding mobile messaging vulnerabilities over the coming months. First, track whether Calif or other security researchers release further technical post-mortems detailing the specific memory corruption mechanics inside the VoIP stack. Second, observe if similar zero-click vulnerabilities emerge in competing real-time communication applications running on iOS and Android. Third, audit enterprise mobile device management policies to enforce rapid patching schedules for messaging and VoIP software across corporate fleets.